[PATCH bpf-next 0/4] bpf path iterator
Song Liu
song at kernel.org
Wed May 28 22:26:19 UTC 2025
In security use cases, it is common to apply rules to VFS subtrees.
However, filtering files in a subtree is not straightforward [1].
One solution to this problem is to start from a path and walk up the VFS
tree (towards the root). Among in-tree LSMs, Landlock uses this solution.
BPF LSM solutions, such like Tetragon [2], also use similar approaches.
However, due to lack of proper helper/kfunc support, BPF LSM solutions
usually do the path walk with probe read, which is racy.
This patchset introduce a reliable helper path_parent, which walks path to
its VFS parent. The helper is use in Landlock.
A new BPF iterator, path iterator, is introduced to do the path walking.
The BPF path iterator uses the new path_parent help to walk the VFS tree
reliably.
[1] https://lpc.events/event/18/contributions/1940/
[2] https://github.com/cilium/tetragon/
Song Liu (4):
namei: Introduce new helper function path_parent()
landlock: Use path_parent()
bpf: Introduce path iterator
selftests/bpf: Add tests for bpf path iterator
fs/namei.c | 39 +++++
include/linux/namei.h | 8 ++
kernel/bpf/Makefile | 1 +
kernel/bpf/helpers.c | 3 +
kernel/bpf/path_iter.c | 74 ++++++++++
kernel/bpf/verifier.c | 5 +
security/landlock/fs.c | 34 ++---
.../testing/selftests/bpf/bpf_experimental.h | 6 +
.../selftests/bpf/prog_tests/path_iter.c | 12 ++
tools/testing/selftests/bpf/progs/path_iter.c | 134 ++++++++++++++++++
10 files changed, 299 insertions(+), 17 deletions(-)
create mode 100644 kernel/bpf/path_iter.c
create mode 100644 tools/testing/selftests/bpf/prog_tests/path_iter.c
create mode 100644 tools/testing/selftests/bpf/progs/path_iter.c
--
2.47.1
More information about the Linux-security-module-archive
mailing list